I. Introduction

In the Philippines, the investigation, arrest, and prosecution of child abuse cases under Republic Act No. 7610 (Special Protection of Children Against Abuse, Exploitation and Discrimination Act) inevitably involve the processing of highly sensitive personal and sensitive personal information of both the child victim and the alleged perpetrator. Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) impose strict obligations on all personal information controllers and processors—including the Philippine National Police (PNP), National Bureau of Investigation (NBI), Department of Social Welfare and Development (DSWD), Department of Justice (DOJ), courts, and even local government units—involved in these cases.

The intersection of RA 7610 and RA 10173 is particularly acute at the moment of arrest and immediate post-arrest publicity, where the constitutional presumption of innocence, the best interests of the child, and the right to privacy collide with the public’s right to information and the State’s interest in deterring child abuse.

II. Core Legal Frameworks

A. Republic Act No. 7610 (as amended)

Defines child abuse broadly to include physical, sexual, and psychological violence, neglect, cruelty, and exploitation.
Provides for warrantless arrests under Rule 113, Section 5(b) of the Rules of Court when the offense has just been committed and there is probable cause based on personal knowledge of facts indicating the person arrested committed it.
Mandates immediate protective custody of the child victim by the DSWD (Section 28).
Explicitly recognizes the confidentiality of proceedings and records involving child victims.

B. Republic Act No. 10173 (Data Privacy Act of 2012)

Applies fully to law enforcement agencies and all government instrumentalities handling RA 7610 cases.
Classifies information about “any offense committed or alleged to have been committed” as sensitive personal information (Section 3[l][3]).
Requires lawful processing based on criteria under Sections 12 and 13 (for sensitive personal information, additional conditions apply).
Mandates proportionality, data minimization, accuracy, and limited retention.
Grants data subjects (both victim and accused) rights to be informed, to object, to access, to rectification, and to damages.

III. Confidentiality Obligations Specific to Child Victims Under RA 7610 and Related Rules

Supreme Court Rules
- Rule on Examination of a Child Witness (A.M. No. 00-4-07-SC, as amended):
  • Section 8 – The child witness shall be identified only by initials or pseudonyms in all pleadings, decisions, and orders.
  • Section 31 – All records of the case shall remain confidential and may not be disclosed except upon court order.
- Rule on Violence Against Women and Their Children (A.M. No. 04-10-11-SC): Confidentiality extends to all records and proceedings.
RA 7610 Implementing Rules and Regulations (as revised) and DSWD guidelines
- Prohibit disclosure of the child’s name, address, school, photographs, or any information that may lead to identification, even indirectly (e.g., naming the barangay in small communities or specifying the exact familial relationship in incest cases).
Media guidelines under NPC and the Kapisanan ng mga Brodkaster ng Pilipinas (KBP)
- Explicitly prohibit identification of child victims or publication of information that may lead to identification.

Any public disclosure by police or prosecutors that enables the identification of the child victim—directly or indirectly—violates both RA 7610 and RA 10173.

IV. Data Privacy Obligations of Law Enforcement During RA 7610 Arrests

A. Lawful Bases for Processing at Arrest Stage

Police may process personal and sensitive personal information of the suspect without consent under:

Section 12(c) – necessary for compliance with a legal obligation (Revised Penal Code, Rules of Court, PNP manuals).
Section 13(e) – necessary for the protection of vitally important interests, including life and health (protection of the child victim).
Section 13(f) – necessary to pursue the legitimate interests of the law enforcement agency (prevention and investigation of crimes).

However, these bases do not grant unlimited authority for public disclosure.

B. Proportionality and Data Minimization in Post-Arrest Publicity

The NPC has consistently ruled (Advisory Opinions 2017-01, 2018-039, 2022-039, and Circulars 2016-02, 2020-04, 2022-01) that:

Once a suspect is in custody, publication of mugshots, full name, address, and other identifiers on social media or press releases is no longer necessary for apprehension and therefore fails the proportionality test.
Posting photographs and personal details of arrested persons constitutes unnecessary processing of sensitive personal information and violates the data minimization principle.
Such publicity often results in “cyber-vigilantism,” online shaming, and irreversible harm to reputation—even if the person is later acquitted or the case is dismissed.
In child abuse cases, the risk of indirect identification of the child victim makes such publicity doubly prohibited.

The NPC has imposed fines ranging from ₱100,000 to ₱4,000,000 on police stations, local government units, and even barangay officials for unauthorized posting of arrested persons’ photos and personal information (see NPC Case Nos. 2019-001 to 2023-145 involving quarantine violators, drug suspects, and other offenders—the same principles apply to RA 7610 cases).

C. Specific NPC Pronouncements Applicable to Child Abuse Cases

NPC Advisory Opinion No. 2017-42: Confirmed that posting of mugshots and personal details of arrested persons on PNP Facebook pages violates the DPA unless there is continuing public safety justification (e.g., the suspect remains at large).
NPC Advisory Opinion No. 2022-039: Explicitly stated that in cases involving minor victims, law enforcement agencies must redact or withhold any information that could lead to the child’s identification, including the suspect’s relationship to the victim when such relationship is unique or identifiable.
NPC Circular 2022-01 (Guidelines on the Use of Body-Worn Cameras and Processing of Images): Even footage from body cameras showing arrested persons must be treated as sensitive personal information and may not be released publicly without strict justification.

V. Practical Implications During and Immediately After Arrest

Permissible actions
- Taking of booking photographs, fingerprints, and personal details for official police records.
- Inclusion of the suspect’s name in the police blotter (internal record, not for public release).
- Coordination with DSWD and prosecutors via secure data-sharing protocols.
Prohibited or highly restricted actions
- “Perp walks” or media parades of the arrested person in connection with child abuse allegations (violates proportionality and risks child identification).
- Posting of mugshots, names, or case details on PNP unit Facebook pages, websites, or press releases when the disclosure is not strictly necessary.
- Allowing media to photograph or film the suspect in a manner that links him/her directly to a child abuse case without redacting identifying information.
- Releasing the exact relationship (“father,” “stepfather,” “uncle,” “teacher”) when such detail, combined with other information, can identify the child in the community.
Recommended police statement template (compliant with NPC guidelines)
“On [date], personnel of [unit] arrested a [age bracket]-year-old male resident of [province/municipality only, if necessary] for violation of Republic Act No. 7610 (Special Protection of Children Against Abuse). The suspect is now in custody and the case has been referred to the prosecutor. The identity of the minor victim is protected by law.”

No name, no photo, no exact address, no relationship specified unless absolutely necessary and approved by the prosecutor or court.

VI. Rights of the Accused Under the Data Privacy Act in RA 7610 Cases

Even alleged child abusers retain data privacy rights:

Right to be informed of the processing (Section 16).
Right to reasonable access to their personal data held by police/DSWD/DOJ.
Right to dispute inaccurate information (e.g., wrong age, address, or allegations recorded).
Right to damages for violation of their privacy rights (Section 34), including unauthorized media exposure orchestrated or allowed by police.

Several acquitted or exonerated persons have successfully filed DPA complaints against police units for permanent online shaming via mugshot postings.

VII. Consequences of Violations

Criminal liability under RA 10173 (Sections 25–34):
- Imprisonment from 1–6 years and fines ₱500,000–₱4,000,000 for unauthorized processing, malicious disclosure, or combination thereof.
Administrative liability against police officers (grave misconduct, conduct prejudicial to the best interest of the service).
Civil liability for damages to both victim (re-traumatization) and accused (if acquitted).
Contempt of court if confidentiality orders are violated.

VIII. Conclusion and Best Practice Recommendations

The arrest phase in RA 7610 cases is the most vulnerable point for data privacy violations because public interest and media attention are at their peak. The Supreme Court, through its rules on child witnesses and confidential records, and the National Privacy Commission, through its consistent advisories and sanctions, have made it unambiguous: law enforcement agencies may not sacrifice the privacy rights of either the child victim or the accused for publicity or deterrence purposes.

Best practices now observed by privacy-compliant PNP units and prosecutors’ offices:

Immediate classification of the case as confidential upon intake.
Use of case pseudonyms from the moment of arrest (“AAA vs. XXX”).
Strict “no photo, no name, no relationship” policy in public statements unless the suspect remains at large.
Execution of data sharing agreements between PNP, DSWD, and DOJ with built-in security measures.
Mandatory DPA training for all officers handling child abuse cases (now required under NPC-DILG Joint Memorandum Circular 2020-0001).

Compliance with the Data Privacy Act in RA 7610 arrests is not merely a technical requirement—it is the operational expression of the State’s paramount duty to protect the best interests of the child while upholding the constitutional rights of all persons.